Analysis It would be nice to know that, if two participants use a protocol, the outcome is good. • No one learns the key they agree to use; • Both of them know the key; The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27
Analysis It would be nice to know that, if two participants use a protocol, the outcome is good. • No one learns the key they agree to use; • Both of them know the key; • Each is aware the other knows the key. The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27
Analysis It would be nice to know that, if two participants use a protocol, the outcome is good. • No one learns the key they agree to use; • Both of them know the key; • Each is aware the other knows the key. For this, we need an appropriate model in which to reason about the protocols. The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27
Analysis It would be nice to know that, if two participants use a protocol, the outcome is good. • No one learns the key they agree to use; • Both of them know the key; • Each is aware the other knows the key. For this, we need an appropriate model in which to reason about the protocols. We analyze the protocol using a Dolev-Yao security model. That is, we create a model consisting of • any number of “normal” agents and The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27
Analysis It would be nice to know that, if two participants use a protocol, the outcome is good. • No one learns the key they agree to use; • Both of them know the key; • Each is aware the other knows the key. For this, we need an appropriate model in which to reason about the protocols. We analyze the protocol using a Dolev-Yao security model. That is, we create a model consisting of • any number of “normal” agents and • one very powerful spy. The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27
Analysis It would be nice to know that, if two participants use a protocol, the outcome is good. • No one learns the key they agree to use; • Both of them know the key; • Each is aware the other knows the key. For this, we need an appropriate model in which to reason about the protocols. We analyze the protocol using a Dolev-Yao security model. That is, we create a model consisting of • any number of “normal” agents and • one very powerful spy. We then prove that the conditions above hold. The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27
Analysis Requirements: needed for: • to model abstract data types messages The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27
Analysis Requirements: needed for: • to model abstract data types messages • to model dynamic systems users’ knowledge The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27
Analysis Requirements: needed for: • to model abstract data types messages • to model dynamic systems users’ knowledge • to use temporal reasoning correctness conditions The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27
Analysis Requirements: needed for: • to model abstract data types messages • to model dynamic systems users’ knowledge • to use temporal reasoning correctness conditions The language CCSL allows all of this. The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27
Analysis Requirements: theory: • to model abstract data types algebra • to model dynamic systems • to use temporal reasoning The language CCSL allows all of this. CCSL is built upon an abstract mathematical foundation. The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27
Analysis Requirements: theory: • to model abstract data types algebra • to model dynamic systems coalgebra • to use temporal reasoning The language CCSL allows all of this. CCSL is built upon an abstract mathematical foundation. The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27
Analysis Requirements: theory: • to model abstract data types algebra • to model dynamic systems coalgebra • to use temporal reasoning Galois algebra The language CCSL allows all of this. CCSL is built upon an abstract mathematical foundation. The Coinductive Approach to Verifying Cryptographic Protocols – p.6/27
Part Two: The Theory The Coinductive Approach to Verifying Cryptographic Protocols – p.7/27
Algebra primer Let Σ be a signature, i.e., Σ = { f ( n i ) | i ∈ I } . i The Coinductive Approach to Verifying Cryptographic Protocols – p.8/27
Algebra primer Let Σ be a signature, i.e., Σ = { f ( n i ) | i ∈ I } . i A Σ -algebra is a set A together with an interpretation for each f i . The Coinductive Approach to Verifying Cryptographic Protocols – p.8/27
� � Algebra primer Example: Σ = { e, − − 1 , ×} . 1 A × A A � � � � � � � − 1 � � e � � � × � � � � A The Coinductive Approach to Verifying Cryptographic Protocols – p.8/27
� Algebra primer Example: Σ = { e, − − 1 , ×} . 1 + A + A × A A The Coinductive Approach to Verifying Cryptographic Protocols – p.8/27
� � � Algebra primer Example: Σ = { e, − − 1 , ×} . 1 + A + A × A FA A A Let F : SET � SET be given. An F -algebra is a set A with a structure FA A The Coinductive Approach to Verifying Cryptographic Protocols – p.8/27
� � Algebra primer Example: Σ = { e, − − 1 , ×} . 1 + A + A × A FA A A For polynomial functors, an F -algebra is a universal algebra. The Coinductive Approach to Verifying Cryptographic Protocols – p.8/27
� � Coalgebra primer Example: 1 + A + A × A FA A A The Coinductive Approach to Verifying Cryptographic Protocols – p.9/27
� � � Coalgebra primer Example: 1 + A + A × A FA A A An F -coalgebra is a set A with a structure FA A The Coinductive Approach to Verifying Cryptographic Protocols – p.9/27
� � � Coalgebra primer Example: 1 + A + A × A FA A A An F -coalgebra is a set A with a structure FA A Think: a coalgebra is a set in which each element can be decomposed as elements of a structured set. The Coinductive Approach to Verifying Cryptographic Protocols – p.9/27
� � Coalgebra primer Example: 1 + A + A × A FA A A Coalgebras model non-well-founded structures, including infinitary trees, streams, etc. The Coinductive Approach to Verifying Cryptographic Protocols – p.9/27
� � Coalgebra primer Example: 1 + A + A × A FA A A Coalgebras can also represent dynamic systems. The Coinductive Approach to Verifying Cryptographic Protocols – p.9/27
� � Coalgebra primer Example: 1 + A + A × A FA A A Coalgebras can also represent dynamic systems. In security protocols, the principals’ knowledge changes over time as messages are sent and received. The Coinductive Approach to Verifying Cryptographic Protocols – p.9/27
� � Coalgebra primer Example: 1 + A + A × A FA A A Coalgebras can also represent dynamic systems. In security protocols, the principals’ knowledge changes over time as messages are sent and received. Hence, we use a coalgebraic model. The Coinductive Approach to Verifying Cryptographic Protocols – p.9/27
Coalgebraic signatures An algebraic signature is given by declarations: f i : X n i � X The Coinductive Approach to Verifying Cryptographic Protocols – p.10/27
Coalgebraic signatures An algebraic signature is given by declarations: f i : F i X � X The Coinductive Approach to Verifying Cryptographic Protocols – p.10/27
Coalgebraic signatures An algebraic signature is given by declarations: f i : F i X � X Equivalently, f : � i F i X � X The Coinductive Approach to Verifying Cryptographic Protocols – p.10/27
Coalgebraic signatures An algebraic signature is given by declarations: f i : F i X � X Equivalently, f : � i F i X � X A coalgebraic signature is given by declarations f i : X � F i X The Coinductive Approach to Verifying Cryptographic Protocols – p.10/27
Coalgebraic signatures An algebraic signature is given by declarations: f i : F i X � X Equivalently, f : � i F i X � X A coalgebraic signature is given by declarations f i : X � F i X Equivalently, f : X � � i F i X The Coinductive Approach to Verifying Cryptographic Protocols – p.10/27
Examples FX Final coalgebra Initial algebra Z × X ∅ infinite streams The Coinductive Approach to Verifying Cryptographic Protocols – p.11/27
Examples FX Final coalgebra Initial algebra Z × X ∅ infinite streams 1 + Z × X finite streams finite and infinite streams The Coinductive Approach to Verifying Cryptographic Protocols – p.11/27
Examples FX Final coalgebra Initial algebra Z × X ∅ infinite streams 1 + Z × X finite streams finite and infinite streams 1 + X × X finite trees finite and infinite trees The Coinductive Approach to Verifying Cryptographic Protocols – p.11/27
Examples FX Final coalgebra Initial algebra Z × X ∅ infinite streams 1 + Z × X finite streams finite and infinite streams 1 + X × X finite trees finite and infinite trees P ω X finite, arb. Kripke frame branching trees The Coinductive Approach to Verifying Cryptographic Protocols – p.11/27
Our coalgebra Spy A B Consider a run with three principals: A , B and the Spy . The Coinductive Approach to Verifying Cryptographic Protocols – p.12/27
Our coalgebra Spy A B Consider a run with three principals: A , B and the Spy . Suppose that A sends a message to B . The Coinductive Approach to Verifying Cryptographic Protocols – p.12/27
� Our coalgebra ! Then, in the next instant, the Spy learns the message. The Coinductive Approach to Verifying Cryptographic Protocols – p.12/27
� Our coalgebra ! Then, in the next instant, the Spy learns the message. Supposing that the message arrives at that time, then... The Coinductive Approach to Verifying Cryptographic Protocols – p.12/27
� � Our coalgebra ! ! ...the next instant, B learns the message, too. The Coinductive Approach to Verifying Cryptographic Protocols – p.12/27
� � Our coalgebra ! ! So, to describe this system, we use a coalgebra with • a method giving the next state, The Coinductive Approach to Verifying Cryptographic Protocols – p.12/27
� � Our coalgebra ! ! So, to describe this system, we use a coalgebra with • a method giving the next state, • attributes describing the action occurring, The Coinductive Approach to Verifying Cryptographic Protocols – p.12/27
� � Our coalgebra ! ! So, to describe this system, we use a coalgebra with • a method giving the next state, • attributes describing the action occurring, • attributes describing the participants’ knowledge. The Coinductive Approach to Verifying Cryptographic Protocols – p.12/27
☎✆ � ☛ � ✡ ✞ � � ✁ ✂ ✄ ✠ � ✄ Our coalgebra ! ! MsgContext : CLASSSPEC METHOD : Self → Self : Self → { idle , sent , received } ✝✟✞ : Self × Princ → [ Message → Bool ] The Coinductive Approach to Verifying Cryptographic Protocols – p.12/27
� � Our coalgebra ! ! We would like to prove, e.g., that The Spy never learns the session key. The Coinductive Approach to Verifying Cryptographic Protocols – p.12/27
� � Our coalgebra ! ! We would like to prove, e.g., that The Spy never learns the session key. For this, we need to reason temporally. The Coinductive Approach to Verifying Cryptographic Protocols – p.12/27
� � Our coalgebra ! ! We would like to prove, e.g., that The Spy never learns the session key. For this, we need to reason temporally. Categories of coalgebras come with temporal operators, which we can understand in terms of Galois algebras. The Coinductive Approach to Verifying Cryptographic Protocols – p.12/27
Galois algebras A Galois algebra is a complete, Boolean algebra P together with an operation [ ]: P � P which preserves meets. The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27
Galois algebras A Galois algebra is a complete, Boolean algebra P together with an operation [ ]: P � P which preserves meets. Think: [ ] P ( x ) means P holds for all successor states of x . The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27
Galois algebras A Galois algebra is a complete, Boolean algebra P together with an operation [ ]: P � P which preserves meets. Think: [ ] P ( x ) means P holds for all successor states of x . With just these assumptions, we can develop a remarkable amount of temporal logic. The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27
Galois algebras � � ← ⊣ [ ] [ ] is part of a Galois connection, with left adjoint � � ← . The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27
Galois algebras � � ← ⊣ [ ] [ ] ← � � Each operator has a conjugate, [ ] ← = ¬� � ← ¬ � � = ¬ [ ] ¬ The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27
Galois algebras � � ← ⊣ [ ] [ ] ← ⊢ � � This yields another Galois connection. The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27
Galois algebras � � ← ⊣ [ ] Next time [ ] ← ⊢ � � In our interpretation, [ ] means “in every next state”. [ ] P = { p | ∀ p → r . P ( r ) } The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27
Galois algebras � � ← ⊣ [ ] Next time [ ] ← ⊢ � � In our interpretation, [ ] means “in every next state”. [ ] P = { p | ∀ p → r . P ( r ) } A proposition P such that P implies [ ] P is called an invariant . The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27
Galois algebras � � ← ⊣ [ ] Next time [ ] ← ⊢ � � In our interpretation, [ ] means “in every next state”. [ ] P = { p | ∀ p → r . P ( r ) } A proposition P such that P implies [ ] P is called an invariant . Invariants are the coalgebraic analogues to inductive predicates. The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27
Galois algebras Some time preceding � � ← ⊣ [ ] Next time Always Some next preceding [ ] ← ⊢ � � time This induces the remaining interpretations. The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27
Galois algebras Some time preceding � � ← ⊣ [ ] Next time Always Some next preceding [ ] ← ⊢ � � time This induces the remaining interpretations. The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27
Galois algebras Some time preceding � � ← ⊣ [ ] Next time Always Some next preceding [ ] ← ⊢ � � time This induces the remaining interpretations. The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27
Galois algebras Some time preceding � � ← ⊣ [ ] Next time Always Some next preceding [ ] ← ⊢ � � time This allows us to represent statements like If B receives a message at time t , then B knows the message at t + 1 . The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27
Galois algebras Some time preceding � � ← ⊣ [ ] Next time Always Some next preceding [ ] ← ⊢ � � time Note: from just a complete partial order with a meet-preserving operator, we get the remaining three operators. The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27
Galois algebras Some time preceding � � ← ⊣ [ ] Next time Always Some next preceding [ ] ← ⊢ � � time Note: from just a complete partial order with a meet-preserving operator, we get the remaining three operators. But wait! There’s more... The Coinductive Approach to Verifying Cryptographic Protocols – p.13/27
☞ Fixed point operators Always We can define an “always” operator via a fixed point construction: P = νZ . P ∧ [ ] Z The Coinductive Approach to Verifying Cryptographic Protocols – p.14/27
☞ ☞ Fixed point operators Always We can define an “always” operator via a fixed point construction: P = νZ . P ∧ [ ] Z P is the greatest invariant contained in P . The Coinductive Approach to Verifying Cryptographic Protocols – p.14/27
☞ ☞ Fixed point operators Always We can define an “always” operator via a fixed point construction: P = νZ . P ∧ [ ] Z P is the greatest invariant contained in P . This operator preserves meets, so we have another Galois algebra. The Coinductive Approach to Verifying Cryptographic Protocols – p.14/27
Fixed point operators Once ✸ ← ⊣ Always ← ⊢ ✸ Previously Eventually This yields the remaining operators and interpretations. The Coinductive Approach to Verifying Cryptographic Protocols – p.14/27
Recommend
More recommend
